diff options
Diffstat (limited to 'ext/mbstring/libmbfl/mbfl/mbfilter.c')
| -rw-r--r-- | ext/mbstring/libmbfl/mbfl/mbfilter.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c index baaa4c3f36..cec6daad94 100644 --- a/ext/mbstring/libmbfl/mbfl/mbfilter.c +++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c @@ -86,6 +86,7 @@ #include <stddef.h> #include <string.h> +#include <limits.h> #include "mbfilter.h" #include "mbfl_filter_output.h" @@ -2552,12 +2553,12 @@ collector_decode_htmlnumericentity(int c, void *data) s = 0; f = 0; if (c >= 0x30 && c <= 0x39) { /* '0' - '9' */ - if (pc->digit > 9) { + s = pc->cache; + if (s > INT_MAX/10) { pc->status = 0; - s = pc->cache; f = 1; } else { - s = pc->cache*10 + c - 0x30; + s = s*10 + (c - 0x30); pc->cache = s; pc->digit++; } |